ci.yml

name: "CI"

on:
  pull_request:
  push:
    branches:
      - develop

jobs:
  #
  # Checks to see what changed
  #
  change-detection:
    permissions:
      contents: read
    runs-on: ubuntu-slim
    outputs:
      is-push: ${{ steps.meta.outputs.is_push }}
      frontend-changed: ${{ steps.changes.outputs.frontend }}
      backend-changed: ${{ steps.changes.outputs.backend }}
      frontend-deps-changed: ${{ steps.changes.outputs.frontend-deps }}
      backend-deps-changed: ${{ steps.changes.outputs.backend-deps }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - id: meta
        run: echo "is_push=${{ github.event_name == 'push' }}" >> "$GITHUB_OUTPUT"
        shell: bash

      - name: Check changed files
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: changes
        with:
          filters: |
            frontend:
              - 'src/**'
              - 'package*.json'
              - 'vite.config.ts'
              - 'tsconfig*.json'
              - '.github/workflows/**'
              - '.github/actions/**'
              - '.github/scripts/**'
            backend:
              - 'src-tauri/**'
              - 'Cargo.*'
              - '.github/workflows/**'
              - '.github/actions/**'
              - '.github/scripts/**'
            frontend-deps:
              - 'package*.json'
              - '.github/workflows/**'
              - '.github/actions/**'
              - '.github/scripts/**'
            backend-deps:
              - 'Cargo.*'
              - '.github/workflows/**'
              - '.github/actions/**'
              - '.github/scripts/**'

  #
  # Backend lint and clippy
  #
  lint-backend:
    needs: change-detection
    if: needs.change-detection.outputs.is-push == 'true' || needs.change-detection.outputs.backend-changed == 'true'
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        platform: ["windows-latest", "ubuntu-22.04", "macos-latest"]
    runs-on: ${{ matrix.platform }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Linux dependencies
        if: matrix.platform == 'ubuntu-22.04'
        uses: ./.github/actions/setup-linux-deps

      - name: Setup Rust
        uses: ./.github/actions/setup-rust

      - name: Check Rust formatting
        run: cargo fmt --manifest-path src-tauri/Cargo.toml -- --check

      - name: Check Rust clippy
        run: cargo tauri-lint

  #
  # Backend tests
  #
  test-backend:
    needs: change-detection
    if: needs.change-detection.outputs.is-push == 'true' || needs.change-detection.outputs.backend-changed == 'true'
    permissions:
      contents: read
      pull-requests: write
    strategy:
      fail-fast: false
      matrix:
        platform: ["windows-latest", "ubuntu-22.04", "macos-latest"]
    runs-on: ${{ matrix.platform }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Linux dependencies
        if: matrix.platform == 'ubuntu-22.04'
        uses: ./.github/actions/setup-linux-deps

      - name: Setup Rust
        uses: ./.github/actions/setup-rust
        with:
          components: ""

      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@f92912fad184299a31e22ad070a5059fd07d4f59 # v2.68.7
        with:
          tool: cargo-llvm-cov

      - name: Run backend tests with coverage
        run: cargo llvm-cov --manifest-path src-tauri/Cargo.toml --no-report -- --test-threads=1 --nocapture

      - name: Generate coverage report
        if: matrix.platform == 'ubuntu-22.04'
        id: coverage-report
        run: |
          {
            echo 'REPORT<<EOF'
            cargo llvm-cov report --manifest-path src-tauri/Cargo.toml 2>&1
            echo 'EOF'
          } >> "$GITHUB_OUTPUT"
        shell: bash

      - name: Report Rust coverage
        if: matrix.platform == 'ubuntu-22.04' && github.event_name == 'pull_request'
        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
        with:
          header: rust-coverage
          message: |
            ## Rust Backend Coverage Report

            <details>
            <summary>Coverage Details</summary>

            ```
            ${{ steps.coverage-report.outputs.REPORT }}
            ```

            </details>

  #
  # Build test
  #
  test-build:
    needs: change-detection
    # When updating npm packages related to tauri, build errors may occur.
    # Therefore, checks should be performed during backend updates and when updating frontend dependencies.
    if: needs.change-detection.outputs.is-push == 'true' || needs.change-detection.outputs.backend-changed == 'true' || needs.change-detection.outputs.frontend-deps-changed == 'true'
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        platform: ["windows-latest", "ubuntu-22.04", "macos-latest"]
    runs-on: ${{ matrix.platform }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Linux dependencies
        if: matrix.platform == 'ubuntu-22.04'
        uses: ./.github/actions/setup-linux-deps
        with:
          extra-packages: "libfuse2 libappindicator3-dev patchelf"

      - name: Fix linuxdeploy permissions
        if: matrix.platform == 'ubuntu-22.04'
        run: chmod +x ./src-tauri/target/release/bundle/appimage/linuxdeploy-*.AppImage || true

      - name: Unset problematic env vars
        if: matrix.platform == 'ubuntu-22.04'
        run: |
          unset GTK_PATH
          unset LD_LIBRARY_PATH

      - name: Cache AppRun binary
        if: runner.os == 'Linux'
        uses: actions/cache@v5.0.3
        with:
          path: ~/.cache/tauri/AppRun-x86_64
          key: tauri-apprun-x86_64

      - name: Pre-download AppRun if not cached
        if: runner.os == 'Linux'
        run: |
          mkdir -p ~/.cache/tauri
          if [ ! -f ~/.cache/tauri/AppRun-x86_64 ]; then
            curl -L https://github.com/tauri-apps/binary-releases/releases/download/apprun-old/AppRun-x86_64 -o ~/.cache/tauri/AppRun-x86_64
            chmod +x ~/.cache/tauri/AppRun-x86_64
          fi

      - name: Cache WiX binary
        if: runner.os == 'Windows'
        uses: actions/cache@v5.0.3
        with:
          path: ~\AppData\Local\tauri\WixTools
          key: tauri-wix-314

      - name: Pre-download WiX if not cached
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $wixDir = "$env:LOCALAPPDATA\tauri\WixTools"
          if (-not (Test-Path $wixDir)) {
            New-Item -ItemType Directory -Force -Path $wixDir
            Invoke-WebRequest -Uri https://github.com/wixtoolset/wix3/releases/download/wix3141rtm/wix314-binaries.zip -OutFile "$wixDir\wix314.zip"
            Expand-Archive -Path "$wixDir\wix314.zip" -DestinationPath $wixDir -Force
            Remove-Item "$wixDir\wix314.zip"
          }

      - name: Setup Node.js
        uses: ./.github/actions/setup-node

      - name: Setup Rust
        uses: ./.github/actions/setup-rust
        with:
          components: ""

      - name: Optimize Windows build environment
        if: matrix.platform == 'windows-latest'
        run: |
          echo "CARGO_INCREMENTAL=0" >> $GITHUB_ENV

      - name: Build with Tauri (CI optimized for PR)
        if: github.event_name == 'pull_request'
        uses: tauri-apps/tauri-action@73fb865345c54760d875b94642314f8c0c894afa # v0.6.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          args: --no-bundle -- --profile ci

      - name: Build with Tauri (Release profile for push)
        if: github.event_name != 'pull_request'
        uses: tauri-apps/tauri-action@73fb865345c54760d875b94642314f8c0c894afa # v0.6.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          args: --no-bundle

  #
  # Frontend Lint
  #
  lint-frontend:
    needs: change-detection
    if: needs.change-detection.outputs.is-push == 'true' || needs.change-detection.outputs.frontend-changed == 'true'
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: ./.github/actions/setup-node

      - name: Frontend lint
        run: npm run lint:ci

  #
  # Frontend tests
  #
  test-frontend:
    needs: change-detection
    if: needs.change-detection.outputs.is-push == 'true' || needs.change-detection.outputs.frontend-changed == 'true'
    permissions:
      contents: read
      pull-requests: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: ./.github/actions/setup-node

      - name: Run frontend tests with coverage
        run: npm test

      - name: Report coverage
        uses: davelosert/vitest-coverage-report-action@2500dafcee7dd64f85ab689c0b83798a8359770e # v2.9.3
        with:
          json-summary-path: coverage/coverage-summary.json

  #
  # Frontend Build
  #
  build-frontend:
    needs: change-detection
    if: needs.change-detection.outputs.is-push == 'true' || needs.change-detection.outputs.frontend-changed == 'true'
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: ./.github/actions/setup-node

      - name: Run frontend build
        run: npm run build

  #
  # License checks
  #
  license-check-npm:
    needs: change-detection
    if: needs.change-detection.outputs.is-push == 'true' || needs.change-detection.outputs.frontend-deps-changed == 'true'
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: ./.github/actions/setup-node

      - name: Generate licenses.json
        run: npm run license-checker

      - name: Check licenses
        run: node --experimental-strip-types .github/scripts/check-licenses.ts licenses.json

      - name: Extract Apache NOTICE
        run: node --experimental-strip-types .github/scripts/extract-apache-notices.ts licenses.json notices

  license-check-cargo:
    needs: change-detection
    if: needs.change-detection.outputs.is-push == 'true' || needs.change-detection.outputs.backend-deps-changed == 'true'
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        platform: ["windows-latest", "ubuntu-22.04", "macos-latest"]
    runs-on: ${{ matrix.platform }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Setup Linux dependencies
        if: matrix.platform == 'ubuntu-22.04'
        uses: ./.github/actions/setup-linux-deps

      - name: Setup Rust
        uses: ./.github/actions/setup-rust
        with:
          components: ""

      - name: Install cargo-deny
        run: cargo install cargo-deny

      - name: Check Rust licenses
        working-directory: src-tauri
        run: cargo deny check licenses

  #
  # Final merge gate: Strict checks for required jobs = success, unnecessary jobs = skipped
  #
  merge-gate:
    name: Merge Gate
    if: ${{ always() }}
    permissions:
      contents: read
    runs-on: ubuntu-slim

    needs:
      - change-detection
      - lint-backend
      - test-backend
      - test-build
      - lint-frontend
      - test-frontend
      - build-frontend
      - license-check-npm
      - license-check-cargo
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: "24"

      - name: Gate (fail on failure/cancelled)
        env:
          NEEDS_JSON: ${{ toJson(needs) }}
        run: node .github/scripts/merge-gate.ts